Skip to content
Fencer Vulns
high 8.3

CVE-2024-3727 json

Containers/image: digest type does not guarantee valid type

published 2024-05-09 2 y ago modified 2026-11-05 3 d ago also GHSA-6wvf-f2vw-3425 , GO-2024-2842 , EUVD-2024-1469

cvss
8.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

Patch / fix

  • go github.com/containers/image 5.30.1
  • go github.com/containers/image/v5 5.29.3, 5.30.1
  • Red Hat OADP-1.3-RHEL-9 1.3.4-9
  • Red Hat Red Hat Advanced Cluster Security 4.4 4.4.5-2, 4.4.5-3, 4.4.5-4
  • Red Hat Red Hat Advanced Cluster Security 4.5 4.5.2-1, 4.5.2-2
  • Red Hat Red Hat Enterprise Linux 8 8100020240808093819.afee755d
  • Red Hat Red Hat Enterprise Linux 9 2:1.16.1-1.el9, 2:1.37.2-1.el9, 2:5.2.2-1.el9
  • Red Hat Red Hat Migration Toolkit for Containers 1.8 v1.8.4-22
  • Red Hat Red Hat OpenShift Container Platform 4.13 2:1.11.3-3.rhaos4.13.el8, 3:4.4.1-13.rhaos4.13.el8
  • Red Hat Red Hat OpenShift Container Platform 4.14 2:1.11.3-3.rhaos4.14.el8, 3:4.4.1-19.rhaos4.14.el8, v4.14.0-202407260439.p0.g8d9b39e.assembly.stream.el8
  • Red Hat Red Hat OpenShift Container Platform 4.15 v4.15.0-202409111636.p0.g9ea52de.assembly.stream.el9, v4.15.0-202409111636.p0.gd80fe46.assembly.stream.el8, v4.15.0-202409111636.p0.gf0c44f6.assembly.stream.el9, v4.15.0-202409120135.p0.g3ab953d.assembly.stream.el9, v4.15.0-202409120135.p0.g8de6f94.assembly.stream.el9, v4.15.0-202409120135.p0.g8425d88.assembly.stream.el9, v4.15.0-202409120135.p0.gf7f5eed.assembly.stream.el9, v4.15.0-202409130735.p0.gc03231f.assembly.stream.el9, v4.15.0-202409131635.p0.gb7c1d6a.assembly.stream.el9, v4.15.0-202409131635.p0.gb73e37f.assembly.stream.el9, v4.15.0-202409131835.p0.gadccbd5.assembly.stream.el9, v4.15.0-202409161436.p0.g1f44c02.assembly.stream.el9, v4.15.0-202409161836.p0.g092d15b.assembly.stream.el9, v4.15.0-202409171307.p0.g5d529dd.assembly.stream.el9, v4.15.0-202409171307.p0.g160e7ca.assembly.stream.el8, v4.15.0-202409171307.p0.ged4651a.assembly.stream.el8, v4.15.0-202409172305.p0.g17536c8.assembly.stream.el8, v4.15.0-202409180105.p0.g1fdd5b0.assembly.stream.el9, v4.15.0-202409180305.p0.g1da79fe.assembly.stream.el9, v4.15.0-202409180905.p0.gf6f61ca.assembly.stream.el8
  • Red Hat Red Hat OpenShift Container Platform 4.16 0:1.29.5-7.rhaos4.16.git7db4ada.el8, 2:1.14.4-1.rhaos4.16.el8, 4:4.9.4-5.1.rhaos4.16.el8, v4.16.0-202407171536.p0.g1551101.assembly.stream.el9, v4.16.0-202409162206.p0.g6a425ab.assembly.stream.el9, v4.16.0-202409231504.p0.g342902b.assembly.stream.el9, v4.16.0-202410172201.p0.gb121e87.assembly.stream.el9
  • Red Hat Red Hat OpenShift Container Platform 4.17 v4.17.0-202409100034.p0.g8d16b39.assembly.stream.el9, v4.17.0-202409101338.p0.gb0d86a0.assembly.stream.el9, v4.17.0-202409122005.p0.gb170ad0.assembly.stream.el9, v4.17.0-202410022234.p0.gfbc55c6.assembly.stream.el9
  • Red Hat Red Hat OpenShift Container Platform 4.18 v4.18.0-202501230001.p0.g5348c85.assembly.stream.el9, v4.18.0-202502040032.p0.ge5a4005.assembly.stream.el9, v4.18.0-202502041302.p0.g51a74ac.assembly.stream.el9, v4.18.0-202502060238.p0.g73d65db.assembly.stream.el9, v4.18.0-202502100153.p0.g120ba67.assembly.stream.el9, v4.18.0-202502100934.p0.gc00c7c9.assembly.stream.el9
  • Red Hat RHEL-9-CNV-4.15 v4.15.5-7
  • golang-github-containers-image Debian 14, Debian 13 5.29.3-1

debian advisories DEBIAN-CVE-2024-3727

  • podman RHEL 9 2:5.2.2-1.el9
  • podman-tests RHEL 9 2:5.2.2-1.el9
  • podman-docker RHEL 9 2:5.2.2-1.el9
  • podman-remote RHEL 9 2:5.2.2-1.el9
  • podman-plugins RHEL 9 2:5.2.2-1.el9
  • skopeo RHEL 9 2:1.16.1-1.el9
  • skopeo-tests RHEL 9 2:1.16.1-1.el9
  • buildah RHEL 9 2:1.37.2-1.el9

red hat advisories RHSA-2024:9102RHSA-2024:9098RHSA-2024:9097RHSA-2024:5258RHSA-2024:7941RHSA-2024:7187

  • podman Linux Micro 6.1 5.2.5-slfo.1.1_1.1
  • govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250207T224745-150000.1.32.1
  • containerized-data-importer Linux Micro 6.0 1.60.1-1.1
  • skopeo Linux Micro 6.0 1.14.4-1.1
  • podman Linux Micro 6.0 4.9.5-1.1
  • apptainer SLE Module for HPC 15 SP6, openSUSE Leap 15.6 1.3.6-150600.4.6.1
  • buildah SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 1.35.4-150400.3.30.1
  • buildah SLE Module for Containers 15 SP6, SLE Module for Containers 15 SP5, openSUSE Leap 15.6 +1 more 1.35.4-150500.3.10.1

suse advisories SUSE-SU-2025:20279-1SUSE-SU-2025:0429-1SUSE-SU-2025:20055-1SUSE-SU-2025:20019-1SUSE-SU-2025:20013-1SUSE-SU-2025:0313-1

  • containerized-data-importer1.65 openSUSE Tumbleweed 1.65.0-1.1
  • containerized-data-importer-1.65 openSUSE Tumbleweed 1.65.0-1.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250130T185858-1.1
  • apptainer Package Hub 15 SP5, openSUSE Leap 15.5 1.3.0-bp155.3.3.2
  • squashfuse Package Hub 15 SP5, openSUSE Leap 15.5 0.5.0-bp155.2.1
  • singularity-ce openSUSE Tumbleweed 4.1.3-1.1
  • apptainer openSUSE Tumbleweed 1.3.0-2.1
  • buildah openSUSE Tumbleweed 1.35.4-1.1

opensuse advisories openSUSE-SU-2026:11074-1openSUSE-SU-2026:11054-1openSUSE-SU-2025:14728-1openSUSE-SU-2024:0244-1openSUSE-SU-2024:14059-1openSUSE-SU-2024:13951-1

  • buildah AlmaLinux 9 2:1.37.2-1.el9
  • buildah-tests AlmaLinux 9 2:1.37.2-1.el9
  • skopeo AlmaLinux 9 2:1.16.1-1.el9
  • skopeo-tests AlmaLinux 9 2:1.16.1-1.el9
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+3845+87b84552
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+3858+6ad51f9f
  • criu AlmaLinux 8 3.18-5.module_el8.10.0+3876+e55593a8
  • criu AlmaLinux 8 3.18-5.module_el8.10.0+3845+87b84552

almalinux advisories ALSA-2024:9097ALSA-2024:9098ALSA-2024:5258

  • podman Rocky Linux 9 4:5.2.2-13.el9_5
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1815+5fe7415e
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
  • runc Rocky Linux 8 1:1.1.12-4.module+el8.10.0+1843+6892ab28
  • udica Rocky Linux 8 0.2.6-21.module+el8.10.0+1815+5fe7415e
  • conmon Rocky Linux 8 3:2.1.10-1.module+el8.10.0+1815+5fe7415e
  • podman Rocky Linux 8 4:4.9.4-12.module+el8.10.0+1843+6892ab28
  • skopeo Rocky Linux 8 2:1.14.5-3.module+el8.10.0+1843+6892ab28

rocky linux advisories RLSA-2024:9102RLSA-2024:5258

  • podman Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 5.0.3-r0
  • skopeo Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 1.15.1-r0
  • buildah Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 1.35.4-r0

alpine advisories ALPINE-CVE-2024-3727

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libcontainers-common Azure Linux 3.0 20240213-2
  • containerized-data-importer Azure Linux 3.0 1.57.0-2
  • containerized-data-importer CBL-Mariner 2.0 1.55.0-19
  • skopeo Azure Linux 3.0 1.14.4-1
  • ig Azure Linux 3.0 0.29.0-1
  • skopeo CBL-Mariner 2.0 1.14.2-4
  • cri-o CBL-Mariner 2.0 1.22.3-3
  • libcontainers-common CBL-Mariner 2.0 20210626-7

azure linux advisories AZL-42315AZL-42318AZL-42319AZL-42327AZL-42330AZL-42331

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-3727 updated cvss 8.3

containers/image: digest type does not guarantee valid type

  • Red Hat OpenShift Developer Tools and Services ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-agent-base-rhel8
    affected: no fix available
  • Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/kn-client-kn-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Source-to-Image (S2I) source-to-image-container
    affected: no fix available
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-db-rhel8, +1 more
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 podman, skopeo, buildah
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +6 more Red Hat Enterprise Linux 9 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 podman, atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, +8 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift-clients, openshift4/ose-cli, openshift4/ose-deployer, openshift4/ose-installer, openshift4/ose-cli-artifacts, openshift4/ose-olm-rukpak-rhel8, +2 more
    affected: no fix available, no fix planned “Will not fix”
show 17 more
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8, rhai-tech-preview/assisted-installer-agent-rhel8, rhai-tech-preview/assisted-installer-reporter-rhel8 Red Hat OpenShift Dev Spaces devspaces/udi-rhel8 Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator, openshift-sandboxed-containers/osc-must-gather-rhel8
    affected: no fix available
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/virt-cdi-cloner, container-native-virtualization/virt-cdi-importer, container-native-virtualization/virt-cdi-operator, container-native-virtualization/virt-cdi-apiserver, container-native-virtualization/virt-cdi-controller, container-native-virtualization/virt-cdi-uploadproxy, +7 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenStack Platform 16.2 osp-director-provisioner-container
    affected: no fix planned “Will not fix”
  • Red Hat CNV 4.15 for RHEL 9 container-native-virtualization/virt-cdi-controller-rhel9 v4.15.5-7
    fixed: vendor fix RHSA-2024:5951
  • Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-velero-plugin-rhel9 1.3.4-9
    fixed: vendor fix RHSA-2024:9960
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-5.module+el8.10.0+22202+761b9a65, criu 3.18-5.module+el8.10.0+22202+761b9a65, crun 1.14.3-2.module+el8.10.0+22202+761b9a65, runc 1.1.12-4.module+el8.10.0+22202+761b9a65, udica 0.2.6-21.module+el8.10.0+22202+761b9a65, conmon 2.1.10-1.module+el8.10.0+22202+761b9a65, +27 more
    fixed: vendor fix RHSA-2024:5258
  • Red Hat Enterprise Linux AppStream (v. 9) podman 5.2.2-1.el9, skopeo 1.16.1-1.el9, buildah 1.37.2-1.el9, podman-tests 5.2.2-1.el9, podman-docker 5.2.2-1.el9, podman-remote 5.2.2-1.el9, +3 more
    fixed: vendor fix RHSA-2024:9097
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-controller-rhel8 v1.8.4-22
    fixed: vendor fix RHSA-2024:7164
  • Red Hat OpenShift Container Platform 4.13 podman 4.4.1-13.rhaos4.13.el8, podman 4.4.1-14.rhaos4.13.el9, skopeo 1.11.3-3.rhaos4.13.el8, skopeo 1.11.3-3.rhaos4.13.el9, podman-tests 4.4.1-13.rhaos4.13.el8, podman-tests 4.4.1-14.rhaos4.13.el9, +11 more
    fixed: vendor fix RHSA-2024:7941
  • Red Hat OpenShift Container Platform 4.14 podman 4.4.1-19.rhaos4.14.el8, podman 4.4.1-19.rhaos4.14.el9, skopeo 1.11.3-3.rhaos4.14.el8, skopeo 1.11.3-3.rhaos4.14.el9, podman-tests 4.4.1-19.rhaos4.14.el8, podman-tests 4.4.1-19.rhaos4.14.el9, +12 more
    fixed: vendor fix RHSA-2024:4960
  • Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202409162258-0, podman 4.4.1-30.rhaos4.15.el8, podman 4.4.1-30.rhaos4.15.el9, skopeo 1.11.3-4.rhaos4.15.el8, skopeo 1.11.3-4.rhaos4.15.el9, podman-tests 4.4.1-30.rhaos4.15.el8, +43 more
    fixed: vendor fix RHSA-2024:6818
  • Red Hat OpenShift Container Platform 4.16 skopeo 1.14.4-1.rhaos4.16.el8, skopeo 1.14.4-1.rhaos4.16.el9, podman 4.9.4-5.1.rhaos4.16.el8, podman 4.9.4-5.1.rhaos4.16.el9, skopeo-tests 1.14.4-1.rhaos4.16.el8, skopeo-tests 1.14.4-1.rhaos4.16.el9, +16 more
    fixed: vendor fix RHSA-2024:4159
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-operator-registry-rhel9 v4.17.0-202409101338.p0.gb0d86a0.assembly.stream.el9, openshift4/ose-machine-config-rhel9-operator v4.17.0-202409122005.p0.gb170ad0.assembly.stream.el9, openshift4/ose-olm-operator-controller-rhel9 v4.17.0-202409100034.p0.g8d16b39.assembly.stream.el9, openshift4/ose-operator-lifecycle-manager-rhel9 v4.17.0-202409101338.p0.gb0d86a0.assembly.stream.el9, openshift4/ose-agent-installer-orchestrator-rhel9 v4.17.0-202410022234.p0.gfbc55c6.assembly.stream.el9
    fixed: vendor fix RHSA-2024:7922
  • Red Hat OpenShift Container Platform 4.18 openshift4/oc-mirror-plugin-rhel9 v4.18.0-202502100934.p0.gc00c7c9.assembly.stream.el9, openshift4/ose-openshift-apiserver-rhel9 v4.18.0-202502060238.p0.g73d65db.assembly.stream.el9, openshift4/ose-machine-config-rhel9-operator v4.18.0-202502100153.p0.g120ba67.assembly.stream.el9, openshift4/ose-agent-installer-api-server-rhel9 v4.18.0-202502040032.p0.ge5a4005.assembly.stream.el9, openshift4/ose-agent-installer-node-agent-rhel9 v4.18.0-202502041302.p0.g51a74ac.assembly.stream.el9, openshift4/ose-agent-installer-orchestrator-rhel9 v4.18.0-202501230001.p0.g5348c85.assembly.stream.el9
    fixed: vendor fix RHSA-2024:6122
  • Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.4.5-4, advanced-cluster-security/rhacs-roxctl-rhel8 4.4.5-2, advanced-cluster-security/rhacs-scanner-rhel8 4.4.5-2, advanced-cluster-security/rhacs-rhel8-operator 4.4.5-2, advanced-cluster-security/rhacs-collector-rhel8 4.4.5-2, advanced-cluster-security/rhacs-operator-bundle 4.4.5-3, +7 more
    fixed: vendor fix RHSA-2024:6054
  • Red Hat RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.5.2-2, advanced-cluster-security/rhacs-roxctl-rhel8 4.5.2-2, advanced-cluster-security/rhacs-scanner-rhel8 4.5.2-2, advanced-cluster-security/rhacs-rhel8-operator 4.5.2-2, advanced-cluster-security/rhacs-collector-rhel8 4.5.2-2, advanced-cluster-security/rhacs-operator-bundle 4.5.2-2, +7 more
    fixed: vendor fix RHSA-2024:6708
  • Red Hat CNV 4.15 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.15.5-5, container-native-virtualization/pr-helper-rhel9 v4.15.5-5, container-native-virtualization/aaq-server-rhel9 v4.15.5-3, container-native-virtualization/virtio-win-rhel9 v4.15.5-2, container-native-virtualization/kubemacpool-rhel9 v4.15.5-3, container-native-virtualization/aaq-operator-rhel9 v4.15.5-3, +43 more Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 python-webob 1.8.8-2.el9, python3-webob 1.8.8-2.el9, openstack-ironic 21.3.1-0.20240911165036.c0d61d0.el9, openstack-ironic-api 21.3.1-0.20240911165036.c0d61d0.el9, python3-ironic-tests 21.3.1-0.20240911165036.c0d61d0.el9, openstack-ironic-common 21.3.1-0.20240911165036.c0d61d0.el9, +5 more Red Hat Ironic content for Red Hat OpenShift Container Platform 4.14 python-webob 1.8.8-2.el9, python3-webob 1.8.8-2.el9 Red Hat Ironic content for Red Hat OpenShift Container Platform 4.15 python-webob 1.8.8-2.el9, python3-webob 1.8.8-2.el9 Red Hat Ironic content for Red Hat OpenShift Container Platform 4.16 python-pyasn1 0.5.1-3.el9, python3-pyasn1 0.5.1-3.el9, pysnmp-lextudio 5.0.26-2.el9, python-eventlet 0.33.1-6.el9, python-gunicorn 20.0.4-4.el9, python3-eventlet 0.33.1-6.el9, +139 more Red Hat Multicluster Engine for Kubernetes multicluster-engine/hive-rhel8, multicluster-engine/agent-service-rhel8, multicluster-engine/assisted-installer-rhel8, multicluster-engine/assisted-installer-agent-rhel8, multicluster-engine/assisted-installer-reporter-rhel8
    +7 more products
    Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-velero-rhel9 1.3.4-10, oadp/oadp-rhel9-operator 1.3.4-13, oadp/oadp-operator-bundle 1.3.4-20, oadp/oadp-mustgather-rhel9 1.3.4-16, oadp/oadp-velero-plugin-for-aws-rhel9 1.3.4-7, oadp/oadp-velero-plugin-for-csi-rhel9 1.3.4-7, +4 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/submariner-rhel8-operator Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-scanner-db-slim-rhel8 Red Hat Ansible Automation Platform 1.2 openshift-clients Red Hat Ansible Automation Platform 2 openshift-clients Red Hat Enterprise Linux 8 conmon, skopeo, buildah, netavark, aardvark-dns, skopeo-tests, +2 more Red Hat Enterprise Linux 9 conmon, netavark, aardvark-dns, containers-common, containers-common-extra
    not affected: vulnerable code not present

10 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.28% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
GitHub 3.1 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/containers/image
<5.30.1
5.30.1
go github.com/containers/image/v5
>=5.30.0, <5.30.1
<5.29.3
5.30.1
5.29.3

Affected products

  • Red Hat OADP-1.3-RHEL-9
  • Red Hat Red Hat Advanced Cluster Security 4.4
  • Red Hat Red Hat Advanced Cluster Security 4.5
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Migration Toolkit for Containers 1.8
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat RHEL-9-CNV-4.15
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat OpenShift Serverless
  • Red Hat OpenShift Source-to-Image (S2I)
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Security 3
  • Red Hat Red Hat Ansible Automation Platform 1.2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat OpenShift Container Platform 3.11
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform Assisted Installer 1
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat Openshift Sandboxed Containers
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat Quay 3

Classification

Weakness
  • CWE-354 Improper Validation of Integrity Check Value

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.